Dump Process List with DLL to File on Windows 8

Q

How to dump the list of all processes with their DLL files that are running on my Windows 8 system? I want save names of all running processes and DLL into a file.

✍: FYIcenter.com

A

You can dump all processes with DLL files they are using on your Windows 8 using the "tastlist.exe" command as shown in this tutorial:

1. Enter "cmd.exe" in the Start button search box. Then click "cmd.exe" in the suggested match list.

2. Enter "tasklist.exe /M *" at the prompt. You will see a list of all running processes with their DLL files, also called modules. Some of them represent one or more services:

Image Name                     PID Modules                            
========================= ======== ===================================
System Idle Process              0 N/A                                
System                           4 N/A                                
smss.exe                       312 N/A                                
csrss.exe                      472 N/A                                
wininit.exe                    528 N/A                                
...

taskhost.exe                  2736 
   ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, msvcrt.dll, RPCRT4.dll, 
   combase.dll, OLEAUT32.dll, CRYPTBASE.dll, bcryptPrimitives.dll, 
   sechost.dll, user32.dll, GDI32.dll, IMM32.DLL, MSCTF.dll, 
   uxtheme.dll, dwmapi.dll, clbcatq.dll, HotStartUserAgent.dll, 
   SHLWAPI.dll, powrprof.dll, dimsjob.dll, taskschd.dll, SspiCli.dll, 
   netprofm.dll, CRYPTSP.dll, rsaenh.dll, npmproxy.dll, 
   TaskSchdPS.dll, apprepsync.dll, ADVAPI32.dll, SHELL32.dll, 
   bcrypt.dll, CRYPT32.dll, ole32.dll, WININET.dll, webservices.dll, 
   NETAPI32.dll, MSASN1.dll, iertutil.dll, netutils.dll, srvcli.dll, 
   wkscli.dll, SHCORE.dll, profapi.dll, WINTRUST.dll, urlmon.dll, 
   Secur32.dll, comctl32.dll, WS2_32.dll, NSI.dll, winhttp.dll, 
   mswsock.dll, IPHLPAPI.DLL, WINNSI.DLL, DNSAPI.dll, rasadhlp.dll, 
   fwpuclnt.dll, schannel.DLL, gpapi.dll, ncrypt.dll, NTASN1.dll, 
   cryptnet.dll, WLDAP32.dll, ncryptsslp.dll, WinStoreUI.dll, 
   WSSync.dll, CFGMGR32.dll, slc.dll, sppcext.dll, PROPSYS.dll, 
   Bcp47Langs.dll, WinSCard.dll, sppc.dll, DEVOBJ.dll, wpnapps.dll, 
   actxprxy.dll, SettingSyncInfo.dll, 
   DeviceSetupManagerAPI.dll               
   
explorer.exe                  2836 ntdll.dll, 
   KERNEL32.DLL, KERNELBASE.dll, msvcrt.dll, OLEAUT32.dll, 
   combase.dll, powrprof.dll, advapi32.dll, USER32.dll, GDI32.dll, 
   SHCORE.dll, SHLWAPI.dll, SHELL32.dll, UxTheme.dll, dwmapi.dll, 
   USERENV.dll, SspiCli.dll, RPCRT4.dll, PROPSYS.dll, gdiplus.dll, 
   sechost.dll, profapi.dll, IMM32.DLL, MSCTF.dll, CRYPTBASE.dll, 
   bcryptPrimitives.dll, ole32.dll, clbcatq.dll, DUI70.dll, 
   Comctl32.dll, DUser.dll, SndVolSSO.DLL, HID.DLL, MMDevApi.dll, 
   DEVOBJ.dll, cfgmgr32.dll, oleacc.dll, wkscli.dll, netutils.dll, 
   explorerframe.dll, WINSTA.dll, Windows.UI.Immersive.dll, 
   CRYPTSP.dll, rsaenh.dll, twinapi.dll, Bcp47Langs.dll, twinui.dll, 
   XmlLite.dll, windows.immersiveshell.serviceprovider.dll, 
   actxprxy.dll, apphelp.dll, CRYPT32.dll, MSASN1.dll, WTSAPI32.dll, 
   IDStore.dll, SAMLIB.dll, WindowsCodecs.dll, wpncore.dll, 
   WININET.dll, iertutil.dll, slc.dll, sppc.dll, dwrite.dll, 
   UIAnimation.dll, dxgi.dll, d3d11.dll, igd10umd64.dll, dcomp.dll, 
   wlidprov.dll, samcli.dll, UIAutomationCore.dll, InputSwitch.dll, 
   sxs.dll, thumbcache.dll, urlmon.dll, MrmCoreR.dll, Bcrypt.dll, 
   windows.globalization.fontgroups.dll, LINKINFO.dll, authui.dll, 
   stobject.dll, BatMeter.dll, SETUPAPI.dll, WINTRUST.dll, 
   Secur32.dll, es.dll, prnfldr.dll, WINSPOOL.DRV, 
   Windows.Networking.Connectivity.dll, npmproxy.dll, AUDIOSES.DLL, 
   dxp.dll, SHDOCVW.dll, Syncreg.dll, AltTab.dll, 
   wpdshserviceobj.dll, PortableDeviceTypes.dll, 
   PortableDeviceApi.dll, SqmApi.dll, pnidui.dll, IPHLPAPI.DLL, 
   NcaApi.dll, NSI.dll, WINNSI.DLL, NetworkStatus.dll, 
   dhcpcsvc6.DLL, WS2_32.dll, dhcpcsvc.DLL, netprofm.dll, 
   srchadmin.dll, CSCAPI.dll, bthprops.cpl, BluetoothApis.dll, 
   Actioncenter.dll, wevtapi.dll, PhotoMetadataHandler.dll, 
   mssprxy.dll, ntshrui.dll, srvcli.dll, SyncCenter.dll, imapi2.dll, 
   ntmarta.dll, hgcpl.dll, provsvc.dll, EhStorShell.dll, 
   IconCodecService.dll, msiltcfg.dll, VERSION.dll, msi.dll, 
   apprepapi.dll, pcacli.dll, MPR.dll, sfc_os.dll, DEVRTL.dll, 
   van.dll, wlanapi.dll, msxml6.dll, datusage.dll, SrumAPI.dll, 
   wcmapi.dll, wpnprv.dll, DPAPI.dll, winhttp.dll, mswsock.dll, 
   DNSAPI.dll, rasadhlp.dll, fwpuclnt.dll, schannel.DLL, ncrypt.dll, 
   NTASN1.dll, ncryptsslp.dll, qmgrprxy.dll, wscinterop.dll, 
   WSCAPI.dll, wscui.cpl, werconcpl.dll, wer.dll, framedynos.dll, 
   wercplsupport.dll, hcproviders.dll, ieproxy.dll, MsftEdit.dll, 
   Windows.Globalization.dll, tiptsf.dll, UIRibbon.dll, 
   UIRibbonRes.dll, NetworkExplorer.dll, StructuredQuery.dll, 
   WINMM.dll, WINMMBASE.dll, dlnashext.dll, DevDispItemProvider.dll, 
   twext.dll, CLVDShellExt.dll, syncui.dll, SYNCENG.dll, 
   NppShell_06.dll, MSIMG32.dll, MSVCR90.dll, cabview.dll, 
   Cabinet.dll, ieframe.dll, MLANG.dll, CHARTV.dll, 
   Windows.Media.Streaming.dll, PhotoViewer.dll, d3d9.dll, 
   PhotoBase.dll, zipfldr.dll, SearchFolder.dll, mmcshext.dll, 
   hhsetup.dll, imagehlp.dll, igfxrENU.lrc, VirtDisk.dll, 
   FLTLIB.DLL, NaturalLanguage6.dll, NLSData0009.dll, 
   NLSLexicons0009.dll, SensApi.dll, webio.dll, gpapi.dll, 
   cryptnet.dll, WLDAP32.dll, timedate.cpl, ATL.DLL, 
   fzshellext_64.dll, RstrtMgr.DLL, 
   Windows.Networking.Sockets.PushEnabledApplic ation.dll, 
   themeui.dll, keepaliveprovider.dll, NInput.dll, DeviceCenter.dll, 
   stapi64.dll, igfxsrvc.dll, Windows.Devices.Sensors.dll, 
   netjoin.dll, igfxpph.dll, hccutils.DLL, igfxdev.dll, igfxress.dll, 
   EhStorAPI.dll                    
...

3. Type in "tasklist.exe /M * > C:\fyicenter\running_processes_with_dll.txt" in the command window. The output will be stored in a file.

Guess how many DLL files are used by the explorer.exe process? There are 221 DLL files used by the explorer.exe process!

By the way, explorer.exe is the Windows Program Manager or Windows Explorer. It manages the Windows Graphical Shell including the taskbar, desktop, and File Manager. By removing this process the graphical interface for Windows will disappear.

 

Process Explorer on Windows 8

Dump Process List with Services to File on Windows 8

"tasklist.exe" Command on Windows 8

⇑⇑ Windows 8 Processes Tutorials

2016-12-30, 1817🔥, 0💬